1.Overview
SawaDoc provides doctor-reviewed treatments, lab tests and health products online. To do that we need some information about you, including information about your health, which Kenyan law treats as sensitive personal data. This policy explains how we handle it.
The data controller is SawaDoc Limited (company registration number PVT-L51DMWOZ), David Osieli Road, Malkya Heights, Westlands, Nairobi, Kenya. Our data protection contact is SawaDoc Limited’s designated Data Protection Officer DPO name to be confirmed, reachable at [email protected].
This policy applies to sawadoc.com, the Patient Portal at portal.sawadoc.com, and the emails and SMS messages we send you.
2.What we collect
Account information. Your email address or phone number (used to send sign-in codes), your name, and, if you sign in with Google, the name, email address and profile picture Google shares with us. We never store a password for you.
Health information. When you request a prescription treatment, the answers you give in the eligibility questionnaire (for example date of birth, sex at birth, height and weight, pregnancy status, medical conditions, medicines and surgeries), your calculated BMI, the outcome of the assessment and the doctor’s decision and notes. For lab tests, the status of your sample and your results.
Order and delivery information. What you ordered, the strength chosen, prices, your delivery name, county, street address and phone number, and the status of each order and refill.
Payment information. Payments are handled by Paystack. We receive a payment reference, the amount, the payment method type (M-Pesa or card) and, for cards you save for refills, a token and the last four digits. We never receive or store your full card number, CVV or M-Pesa PIN.
Communication records. Which service emails and SMS we sent you and whether they were delivered.
Technical information. Standard server logs (IP address, browser type, pages requested, request identifiers) used to keep the Service secure and working. Our logs are designed not to contain your health information, one-time codes or payment details.
3.How we use it
- To create your account and let you sign in securely with one-time codes or Google.
- To let a licensed doctor assess whether a treatment is suitable for you, and to record that decision.
- To fulfil your orders: preparing them in our pharmacy, delivering them, and keeping a record of which batch of medicine you received so we can contact you if a product is ever recalled.
- To process lab tests with our partner laboratory and release your results to your Patient Portal.
- To send you service messages about sign-in, orders, the doctor’s decision, dispatch, delivery, lab updates, refills and refunds.
- To run monthly refills you have chosen, including reminders and payments.
- To issue receipts and credit notes, keep accounts and meet our tax and record-keeping obligations.
- To keep the Service secure, prevent fraud and misuse, and enforce our Terms and Conditions.
- To send reorder reminders for one-off purchases, which you can switch off at any time.
We do not sell your personal data, and we do not use your health information for advertising.
4.Our legal grounds
Under the Data Protection Act, 2019 we rely on the following grounds:
- Your explicit consent to process your health information, which you give when you accept the consent at checkout. You can withdraw it at any time, although we may then be unable to provide a treatment, and we may still need to keep records we already hold (see Retention).
- Performance of our contract with you, for creating your account, taking and fulfilling orders and running refills.
- Our legal obligations, such as tax, accounting and medicine-dispensing records.
- Our legitimate interests in keeping the Service secure and preventing misuse, which we balance against your rights.
6.Discreet communications
Our emails and SMS messages never include a diagnosis, a medicine name or a test result. They tell you that something has happened (for example that your results are ready) and point you to the Patient Portal, where you sign in to see the details.
8.How long we keep it
We keep your account for as long as it is open. Health assessments, prescriptions, dispensing records and lab results are medical records: we keep them for 7 years after your last transaction with us, even if you close your account, and longer where Kenyan law or professional guidance requires.
Financial, payment and transaction records, including receipts and credit notes, are kept for 5 years as our internal policy, or longer where tax or accounting obligations require.
Receipts, credit notes and payment references are kept for the period required by tax law. Server logs are kept for a short period for security purposes and then deleted.
9.How we protect it
- All connections to the Service are encrypted (HTTPS).
- Sign-in uses one-time codes or Google, so there is no SawaDoc password to be stolen. Codes expire within minutes and requests are rate-limited.
- Session cookies are secure and cannot be read by browser scripts.
- Staff access is restricted by role, and every request is checked by the server, not just hidden in the interface.
- Payment card details are handled entirely by Paystack.
- Lab results are stored in private storage, and every time a result is viewed is logged.
No system can be completely secure. If we become aware of a breach that affects your personal data, we will notify you and the Office of the Data Protection Commissioner as the law requires.
10.Your rights
Under the Data Protection Act, 2019 you have the right to:
- Be told what personal data we hold about you and how we use it.
- Access a copy of your personal data, including your health assessments and results, most of which you can see in the Patient Portal.
- Have inaccurate or incomplete data corrected.
- Ask us to delete your data, where we are not required to keep it (for example as a medical or financial record).
- Object to or restrict certain processing, and withdraw consent you have given.
- Receive your data in a portable format.
- Complain to the Office of the Data Protection Commissioner (ODPC) if you are unhappy with how we handle your data.
To exercise any of these rights, contact [email protected]. We will respond within the time allowed by law and may ask you to confirm your identity first.
11.Children
The Service is for adults aged 18 and over. We do not knowingly collect information from anyone under 18. If you believe a child has created an account, please contact us and we will remove it.
12.Where your data is stored
Our servers, database and file storage are hosted in Nairobi, Kenya, in an ISO 27001-certified data centre. Your personal data, including your health information, questionnaire answers, prescriptions and lab results, is stored and processed in Kenya, and so are our backups. Payment processing by Paystack takes place in Kenya.
A few service providers process limited information outside Kenya: our email delivery provider processes your email address and our service emails in the European Union, our SMS delivery provider may process your phone number and our text messages outside Kenya, Cloudflare processes your IP address and requests to sawadoc.com in its global network to deliver and protect the site, and if you choose to sign in with Google, Google processes that sign-in.
Where data leaves Kenya we make sure appropriate safeguards are in place as required by the Data Protection Act, 2019, including contractual protections with each provider and encryption in transit and at rest.
13.Changes to this policy
We may update this policy as the Service changes. The date at the top shows when it was last updated; for significant changes we will tell you by email or in the Patient Portal.
Questions about this policy or your data: [email protected].